summaryrefslogtreecommitdiff
path: root/libre
diff options
context:
space:
mode:
authorAndré Fabian Silva Delgado <emulatorman@parabola.nu>2014-07-30 19:53:48 -0300
committerAndré Fabian Silva Delgado <emulatorman@parabola.nu>2014-07-30 19:53:48 -0300
commit9f6ae13fc72cd48c1c61bc2b5be2c9bd28c5ce43 (patch)
tree9dbe16ac7e4b9bee99510e2c3968415fd78a5496 /libre
parent752d55343df5033d2b6956e8d23863dd639a27d9 (diff)
kdelibs-libre-4.13.3-2: fix CVE-2014-5033
Diffstat (limited to 'libre')
-rw-r--r--libre/kdelibs-libre/PKGBUILD11
-rw-r--r--libre/kdelibs-libre/kdelibs-cve-2014-5033.patch36
2 files changed, 43 insertions, 4 deletions
diff --git a/libre/kdelibs-libre/PKGBUILD b/libre/kdelibs-libre/PKGBUILD
index 498a341bb..14bba6a23 100644
--- a/libre/kdelibs-libre/PKGBUILD
+++ b/libre/kdelibs-libre/PKGBUILD
@@ -1,4 +1,4 @@
-# $Id: PKGBUILD 217476 2014-07-18 18:34:16Z andrea $
+# $Id: PKGBUILD 218409 2014-07-30 20:11:02Z svenstaro $
# Maintainer (Arch): Andrea Scarpino <andrea@archlinux.org
# Contributor (Arch): Pierre Schmitz <pierre@archlinux.de>
# Maintainer: André Silva <emulatorman@parabola.nu>
@@ -6,7 +6,7 @@
_pkgname=kdelibs
pkgname=kdelibs-libre
pkgver=4.13.3
-pkgrel=1
+pkgrel=2
pkgdesc="KDE Core Libraries, without nonfree plugins recommendation support"
arch=('i686' 'x86_64' 'mips64el')
url='https://projects.kde.org/projects/kde/kdelibs'
@@ -22,12 +22,13 @@ makedepends=('cmake' 'automoc4' 'avahi' 'libgl' 'hspell' 'mesa')
install=${_pkgname}.install
source=("http://download.kde.org/stable/${pkgver}/src/${_pkgname}-${pkgver}.tar.xz"
'kde-applications-menu.patch' 'khtml-fsdg.diff' 'qt4.patch'
- 'pyqt.patch')
+ 'pyqt.patch' 'kdelibs-cve-2014-5033.patch')
sha1sums=('9c0e963fa2db119ac37e15f31c05d18d3043a58e'
'86ee8c8660f19de8141ac99cd6943964d97a1ed7'
'a1502a964081ad583a00cf90c56e74bf60121830'
'ed1f57ee661e5c7440efcaba7e51d2554709701c'
- 'd32534d7d6dc287c80951d24caf0259ab18c9abc')
+ 'd32534d7d6dc287c80951d24caf0259ab18c9abc'
+ '9c808a7e382f59d730a4ced06ef88165f3d87eec')
prepare() {
mkdir build
@@ -41,6 +42,8 @@ prepare() {
# support newer PyQt build system
patch -p1 -i "${srcdir}"/pyqt.patch
+
+ patch -p1 -i "${srcdir}/kdelibs-cve-2014-5033.patch"
}
build() {
diff --git a/libre/kdelibs-libre/kdelibs-cve-2014-5033.patch b/libre/kdelibs-libre/kdelibs-cve-2014-5033.patch
new file mode 100644
index 000000000..c85eccd6b
--- /dev/null
+++ b/libre/kdelibs-libre/kdelibs-cve-2014-5033.patch
@@ -0,0 +1,36 @@
+--- a/kdecore/auth/backends/polkit-1/Polkit1Backend.cpp
++++ b/kdecore/auth/backends/polkit-1/Polkit1Backend.cpp
+@@ -144,7 +144,7 @@
+
+ Action::AuthStatus Polkit1Backend::actionStatus(const QString &action)
+ {
+- PolkitQt1::UnixProcessSubject subject(QCoreApplication::applicationPid());
++ PolkitQt1::SystemBusNameSubject subject(QString::fromUtf8(callerID()));
+ PolkitQt1::Authority::Result r = PolkitQt1::Authority::instance()->checkAuthorizationSync(action, subject,
+ PolkitQt1::Authority::None);
+ switch (r) {
+@@ -160,21 +160,12 @@
+
+ QByteArray Polkit1Backend::callerID() const
+ {
+- QByteArray a;
+- QDataStream s(&a, QIODevice::WriteOnly);
+- s << QCoreApplication::applicationPid();
+-
+- return a;
++ return QDBusConnection::systemBus().baseService().toUtf8();
+ }
+
+ bool Polkit1Backend::isCallerAuthorized(const QString &action, QByteArray callerID)
+ {
+- QDataStream s(&callerID, QIODevice::ReadOnly);
+- qint64 pid;
+-
+- s >> pid;
+-
+- PolkitQt1::UnixProcessSubject subject(pid);
++ PolkitQt1::SystemBusNameSubject subject(QString::fromUtf8(callerID));
+ PolkitQt1::Authority *authority = PolkitQt1::Authority::instance();
+
+ PolkitResultEventLoop e;
+